17 2 “ 12056 



fMASA TECHNICAL NASA TM X -67953 

MEMORANDUM 



<S) 

<c 

2 


MISHAPS WITH OXYGEN IN NASA OPERATIONS 


by Paul M. Ordin 
Lewis Research Center 
Cleveland, Ohio 


TECHNICAL PAPER proposed for presentation at 
! Oxygen Compressors and Pumps Symposium 
sponsored by the Compressed Gas Association 

jf# 

Atlanta, Georgia, November 9-11, 1971 

m' | ; 



-6604 


MISHAPS WITH OXYGEN IN NASA OPERATIONS 

by Paul M. Ordin 
NASA - Lewis Research Center 

INTRODUCTION 

The successful design and operation of oxygen systems in aerospace 
appl i cat ions have been based on the technologies developed by both 
industrial organizations, involved in the production and use of oxygen, 
and the government agencies, primarily concerned with its use. NASA has 
used over 8.5 million pounds of oxygen in a single operation and the storage, 

supply, and flow systems have been designed with safety as a major considera- 
tion. 

Accidents/incidents with oxygen in our aerospace operations have 
occurred and some have been extremely costly in life and materials. In order 
to increase the safety of handling oxygen the Aerospace Safety Research and 
Data Institute at the NASA - Lewis Research Center is conducting a number of 
safety-related research projects which include a review of oxygen systems 
safety practices. The oxygen safety programs include a review of the hazards, 
the available data concerning the failure of components and systems in oxygen 
use, and the oxygen handling procedures followed by NASA and its contractors. 
These studies are expected to provide information for the development of 
design and operational criteria and standards to increase the reliability of 
oxygen systems and minimize the probability of the occurrence of future 
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mishaps. A study of the scope and magnitude of mishaps also provides 
needed information on the selection of alternative components and/or systems. 

The propulsion, power and life-support systems presently under develop- 
ment for use in earth orbit manned missions use large quantities of oxygen. 

The systems specifications include requirements for extended life and reuse 
capabilities which could result in an increase in the number of accidents 
unless continuing efforts are applied to the safety of the oxygen systems. 

NASA SAFETY GOAL 

A single safety goal has been imposed by NASA, as a basic ground rule, 
on the Space Station Phase B study contractors. This is; "As a goal, no 
single malfunction or credible combination of malfunctions and/or accidents 
shall result in serious injury to personnel or to crew abandonment of the space 
station." Credible accidents with oxygen could best be established from 
past experience. A review of accident/incident information to define the 
accident, its cause, and to recommend modifications, contributes to a better 
understanding of the hazards of oxygen which include fire, explosion, leakage 
and loss of pressurization. 

This paper presents information from a substantial number of oxygen 
mishaps obtained primarily from NASA and contractor records. Information 
from several Air Force records, concerning oxygen accidents involving aircraft 
operations, are also included. The description of the mishaps and their causes, 
with both liquid (LOX) and gaseous oxygon (GOX) in ground test facilities and 
space vehicle systems are included in Appendix A. The mishaps are listed 
under the general heading of Acc i dents/ 1 nc idents and not identified as to the 
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type of mishap according to NASA standards. The NASA Safety Manual (ref. 1) 
defines the various types of mishaps according to the degree of severity; 

Type A Accident, Type B Accident, Incident, Mission Contingency and Aviation 
Flight Accident (Appendix B) . 

This paper also includes a number of safety regulations aimed at reducing 
the accident probability. The problems related to material compatibility and 
materials testing are discussed, indicating the limited information on factors 
affecting the ignition of materials in oxygen. In addition, details are given 
of several of the accidents/incidents listed in Appendix A to define the com- 
bination of conditions causing the mishap. The need for further research is 
also indicated. 

The principal source of the oxygen accident information was a compilation 




(ref. 2). 

About 500 accidents/incidents were selected from approximately 10,000 
documents reviewed and are published in the reference report. The selections 
were based on mishaps which reflected significant lessons and on occurrences 
which involved equipment and facilities providing direct support to the space 
program and on occurrences resulting in personnel fatalities and/or injuries. 
The description of the mishaps, possible causes, and recommended corrective 
actions are included. In addition to propellant system mishaps, the reference 
report includes accident/incidents which have occurred to space and ground 
system structures, electrical systems, ground support facilities, ordnance 
and related operations. The mishaps pertaining to oxygen were selected from 
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the reference report and are included in this paper* In addition, oxygen 
mishaps which have occurred in programs not specifically identified with the 
Manned Space Program are included* 

Although many of the mishap reports did not contain completely 
satisfactory information as to the technical coverage of the causes and 
corrective actions, the available information was used to establish categories 
of events causing the mishap. The causes have been categorized in an effort 
to obtain additional lessons from the mishap reports. The categories include 
the following j 

A. Materials Incompatibility Deficiency 

This basic cause of oxygen mishaps includes incompatible materials 
brought together because of errors in design, installation, fabrication 
and operational procedures. 

B . Materials Failure 

Includes failure of materials or components due to stresses within 
the design limits. These include failures of pipes, tubing, valves, 
pump, etc. during operation or during development tests under conditions 
within their design specifications. 

C. Design Deficiency 

Includes inadequate component or system design specifications which 
contributed to the occurrence of the mishap. 

D . Cleaning Deficiency 

This factor has been identified as a separate cause which con- 
tributed or was responsible for the mishap. 
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E. Procedural Deficiencies 

This cause factor includes inadequate operating procedures, 
planning, training, quality control, and management supervision. 

The distribution of the acc idents/ i ncidents according to these basic 
deficiencies for LOX is shown in Figure 1 and for GOX in Figure 2. A total 
of 55 mishaps for liquid oxygen and 47 for gaseous oxygen are listed in 
Appendix A and were used to establish the distribution shown in the figures. 

In most cases, more than one cause factor was considered as being responsible 
for the mishap. For both liquid and gas, procedural deficiencies caused 
the largest number of mishaps, closely followed by design deficiencies. 

Figure 3 shows the comparison of the number of mishap causes for the 
liquid and gaseous oxygen. Note the substantial increase in gaseous oxygen 
mishaps due to material incompatibility. With respect to possible reactions 
between the materials and oxygen, we should expect a greater number of mishaps 
with gaseous oxygen since a small volume of gas is generally a prerequisite 
to the ignition of the material. The thermal mechanism of ignition assumes 
hot spots could not occur without the presence of the gaseous phase at the 
spot. The large heat sink provided by LOX contact precludes hot spots on 
immersed materials unless the heat source is strong and is abetted by con- 
current chemical reactions between LOX and the material being heated. The 
liquid, therefore, would have a reduced effect on initiating any reaction 
of the materials with oxygen until sufficient heat was transferred to form 
the gaseous state. Adiabatic compression as a means of producing high 
temperature for ignition of the materials also becomes inefficient at 
cryogenic temperatures. The theoretical temperature due to adiabatic com- 
pression can be calculated from the values of final and initial pressure and 
the ratio of specific heats (1.4 for oxygen). A pressure ratio of about 47, 
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capable of producing a temperature ratio of 3 , would heat oxygen, initially 
at 300°K to 900 °K whereas the same pressure ratio applied to oxygen at 90 . 1 °K 
would heat a gas bubble to 270°K. Temperatures of 900°K could be obtained 
in a cold gas bubble but the pressure required would be about 3100 atm. if 
the initial pressure was 1 atmosphere. 

Material failures account for more mishaps in liquid than gaseous 
oxygen and are probably due to the change in mechanical properties of the 
materials used at the low temperatures. The change in toughness for both 
ductile and brittle materials at low temperatures are usually taken into 
account in the design of equipment but this information is probably the 
least understood of the low temperature mechanical properties. Toughness 
measurement techniques include impact tests, notch tensile tests and tensile 
elongation tests but the behavior of the materials under stress, especially 
in the presence of flaws, at the low temperatures are not sufficiently under- 
stood to avoid mishaps. 

The distribution of the mishaps according to the deficiencies listed 
show many outstanding examples of failures to heed safety procedures as well 
as many areas for improvement. The preparation of detailed procedures for 
the handling of oxygen and the enforcement of such procedures would reduce 
the number of mishaps. These procedures should include not only details for 
the safe operation of oxygen systems but also the presentation of the planning, 
training, quality control and management supervision methods to enforce 
the recommended procedures. Improvements in both component and systems design 
would also have a major effect in reducing the number of mishaps. 
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Fires and explosions have been responsible for the major losses in 
equipment and for most of the fatalities that have occurred. The materials 
react with the gaseous oxygen but the source of ignition responsible for 
the initiation of the fire and explosion mishaps is difficult to isolate. 

The accident/incident studies have indicated that impact, friction, 
chemical reactivity, static electricity, electrical sparks, and heat due to 
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gas compression have all been responsible for the ignition of some materials 
in oxygen. 

A number of practical safety regulations could be introduced to reduce 
accidents caused by procedural and design deficiencies, but mater : al com- 
patibility and ignition problems are more difficult to resolve. What 
materials to use for a specific environment of gas or liquid oxygen, high 
or low pressure, etc. for positive safe performance cannot be answered. 
Methods of evaluating and rating materials for oxygen use have been developed 
(ref. 3? 5) and these studies are being continued. These evaluation 

tests include determinations of flash and fire point and impact sensitivity 
of materials. The flash and fire point tests were developed to determine 
relative reactivity of materials when subjected to an electrical discharge. 
The flash point is the lowest temperature at which a material will give off 
flammable vapors that, when mixed with the test atmosphere and exposed to 
the spark energy, will provide a non-self-sustaining flash or flame. The 
fire point is similar except the ■ material gives off flammable vapors 
which continue to burn after ignition. Although many of the mishap causes 
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indicate the use of non-compatible materials, mishaps have taken place 
under conditions for which compatible materials, based upon evaluation 
tests, were used. The conditions under which the materials will or will not 
ignite in oxygen are difficult to prescribe. The ease of igmtion depends 
upon the state of subdivision of the material, presence of foreign materials 
and many other circumstances. Structural metals generally burn in oxygen 
only after heating to relatively high temperatures. However, iron, lead, 
nickel and many other metals ignite spontaneously in air if sufficiently 
finely divided. The foreign material in an oxygen system frequently exerts 
a major effect on the rate of oxidation reactions, hence the need to design 
an oxygen system in a way that facilitates rigorous cleaning. The effects 
of velocity, mass and shape of a particle striking a component in the oxygen 
system are not sufficiently clear. Ignition of materials in lines, pumps, 
and valves have been attributed to particle impacts. Methods for preventing 
ignition by abrasion or friction, a cause estimated to have been responsible 
for a number of mishaps, cannot be adequately defined. 

Polymeric materials have been recommended for use in oxygen systems 
based on oxygen sensitivity tests, but these materials may still present 
a safety hazard in aerospace applications. The polytetraf 1 uoroethyl ene 
insulations as well as many of the metals used are potential fuels and all 
that is required is an ignition source of sufficient energy. Teflon and other 
polymeric materials may be particularly efficient sources of ignition for 
aluminum and other metals because the decomposition products of the fluorides 
tend to remove the protective oxide from these metals. In addition, the 
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recommended materials, when tested in oxygen-rich environments, may be non- 
igniting or self-extinguishing or slow burning, but the decomposition products 
may be toxic and present hazards to personnel. Toxic gases and vapors given 
off include carbonyl fluoride (C0F 2 ), carbon monoxide (CO), formaldehyde 
(H 2 C0), phosgene (F 2 C0), hydrogen fluoride (HF), chloroform (HCCl^), hydrogen 
cyanide (HCH) and carbonyl chloride (C1 2 C0). Results of thermal -decompos i t i on 
toxicity evaluations as a function of temperature for many of the polymeric 
materials have been compiled by the Aerospace Corporation and 1 are shown in 
Figure 4 (ref. 6) . 

The thermal -decompos i t ion toxicity index I, a direct measure of the 

hazard due to toxic product production, is defined as: 

,i 


k >2 • P . /LC cn 
- i i 50 


where k is the rate constant for decomposition of the polymer (hr ) and is 
a function of the decomposition temperature T; P. is the mol percent of 
decomposition product i in the product gases; and LC^g is the toxicity of 
the product i in ppm. 

The order of relative toxicity for the polymeric materials when heated 
from 500°F to 700°F shows Teflon TFE to be least toxic followed by Teflon 
FEP, polyimide film, Viton, perf 1 uoropropyl ene polymer and carboxy nitroso 
rubber. At lower temperatures the order of merit is slightly altered, also, 
at higher temperatures, there may be rearrangements of the decomposition 
products so that substantial changes may occur in the toxicity indexes. The 
fact that all materials will produce toxic decomposition products when heated, 
points out the need for accident and fire protection to restrict burning of 
the material for the safety of the NASA manned missions. 
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SAFETY RECOMMENDATIONS 

Although the solution to many of the problems which caused the oxygen 
mishaps cannot be specifically prescribed without further research and 
development efforts, several practical safety regulations are recommended 
to increase the operational safety. These recommendations based on specific 
mishaps in Appendix A include the following: 

(a) Prevent the cross connecting of fuel, oxygen and purge lines by 
means of designs and permit no subsequent uncontrolled revisions 
by maintenance personnel. 

(b) Suitably restrain all flexible lines at specific intervals. 

(c) Prevent the venting and disposal of oxygen near electrical 
systems or other ignition sources capable of initiating and 
promoting fires. 

(d) Provide controlled valve operation of oxygen valves to limit 
generation of heat due to gas compression. 

(e) Label pressure lines with values of operational, proof, and 
design burst pressure. 

(f) Conduct pre-operational hazard analyses on liquid and gaseous 
pressure systems before checkout, operation or maintenance. 

(g) Insure verification of pressure relief before liquid and gas lines 
are disconnected. 

(h) Emphasize hazards of operations in oxygen systems through training. 
Many operating personnel are not fully aware of the hazards associated 
with oxygen systems. 

(i) Maintain records of any rework on tanks, lines and related equip- 
ment. The operations performed should be available to evaluate 
continued use of equipment. 
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(j) Fluids used should be identified and environmental chamber 
operations include a verification of the composition of the 
gas mixtures employed. 

(k) Liquid oxygen loading rates should be established commensurate 
with duct and equipment fatigue capacities. Materia] failures 
have been induced by low stress, high frequency vibrations caused 
by excessive fill rates. Instrumentation should be installed to 
measure and monitor induced vibrations. 

(l) Standards should be established interfacing the electrical systems 
to the oxygen systems. Problems of electrical arcing of interior 
lights and fixtures should be resolved. 

(m) Insure availability of recent information on results of testing 
and of field experiences on the compatibility of materials with 
oxygen . 

DISCUSSION OF SELECTED MISHAPS 

The review of the reports indicates the mishaps are caused by a number 
of interacting factors. An effort was made in this paper to identify the 
cause as one of several basic deficiencies. In order to illustrate the 
interaction of deficiencies responsible for each mishap, a more detailed 
description, than is presented in the Appendix A, is given for the failure 
of an oxygen regulator, the motor vehicle fire at the launch pad and the 
Apollo 13 flight mishap. 

1 . Failure of Oxygen Resuscitator 

During checkout of a 100% oxygen type resuscitator, a flash fire 


occurred in the high pressure side of the resuscitator. The unit was 
charged with 2200 psig oxygen and was being readied as emergency 
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equipment for launch facility operations. The probable source of 
the fire was the regulator primary seat made of nylon. Ignition 
was most likely promoted by small metal particles which were found 
in the system. A schematic diagram of the resuscitator regulator is 
shown in Figure 5 and a photograph of the ruptured safety valve in 
Figure 6. A view into the regulator body illustrating the burned 
portions is shown in Figure 7 • 

The mishap was caused by procedural deficiencies which did not 
provide sufficient quality control; by the use of incompatible materials 
and by system design limitations resulting in galling between the 
stainless steel inlet valve camshaft and aluminum housing. The galling 
of the metals was most likely responsible for the metal particles found 
in the system. Redesign of the inlet valve camshaft assembly and the 
installation of a filter screen in the regulator are minimum changes 
required. The various rubber and plastic soft goods used in the 
regulator are listed in Table 1. With the exception of the TFE Teflon 
on the regulator inlet valve seat, all the materials are considered 
incompatible with high pressure oxygen systems. 

Although the accident occurred with a particular make resuscitator, 
an inspection of oxygen resusci tators and pure breathing apparatus 
manufactured by other firms was conducted. Resusc i tators manufactured 
by 5 firms were examined and on the basis of acceptability or non- 
acceptability of each item primarily determined on data contained in 
NASA publication, Materials Compatibility for Gaseous Oxygen Systems 
(ref. 7 ) > approximately 50 to 90% of the materials analyzed in each 
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resuscitator were unacceptable. Acceptable substitutes have been 
recommended . 

2. Motor Vehicles Fire at Launch Pad 

During launch pad clearing operations, three security cars were 
driven into an oxygen enriched area, the guards parked their cars, 
shut the engines, and got out for an inspection of the area. The LOX 
which was being dumped as part of normal operations vaporized and 
created an oxygen cloud which drifted into the path of the cars causing 
severe fire damage to the three vehicles. Prior to and during LOX 
pump operations for loading the Apollo Saturn vehicle, the LOX used in 
the storage area piping chilldown is normally drained into a ditch 
beyond a perimeter fence. Location of the LOX storage tank, three 
parked cars and drainage ditch is shown schematically in Figure 8. The 
drainage ditch approximately 40 ft. wide and 5 ft. deep is located about 
227 ft. from the liquid oxygen storage tank. 

A schematic showing the LOX chilldown outlets to the ditch is shown 
in Figure 9- Outlet number 1 used to chilldown the 1000 gpm pump was 
opened for 40 minutes and dumped 8000 gallons into the ditch. Outlet 
number 2 used to chilldown the 18" tee at the suction inlet of the 
10,000 gpm, dumped a total flow of 2250 gals. Outlet number 3, used 
to chilldown the 10,000 gpm, and outlet number 4, opened after the 
three minute drain of outlet 3, passed a total of 860 gallons into the 
drainage ditch. The quantity of LOX dumped into the ditch was about 
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11,000 gallons and would be sufficient for a gaseous oxygen volume 
to cover areas of roughly 5 , 10 and 20 acres to a depth of 4 ft. at 
concentrat ions in 100, 60 and 40% oxygen. 

Results of the investigation indicated that two of the three 
vehicles caught fire in the engine compartment by autoignition re- 
sulting from engine heat, combustibles and enriched oxygen atmosphere. 

The other vehicle apparently ignited as the driver attempted to start 
the engine. This vehicle was also in the oxygen enriched environment. 

A photograph showing the burned cars and their positions with 
respect to the fence and oxygen tank is shown in Figure 10. Detail 
comments from the official report on the accident (ref. 8) concerning 
results of the examination of each of the cars included the following: 

Car No. 1 - Close-up Photograph Shown in Figure 11 

(a) The fire was first observed by the operator in the engine 
compartment which upon examination indicated the most intense 
heat. It is believed that the point of ignition occurred in 
the engine compartment. 

(b) The driver stated that vehicle had been operated for a sufficient 
time to be at normal operating temperature and that the vehicle 
ignition had been off for approximately five minutes when fire 
was first noticed. 

(c) Normally, engine metal under the above conditions would attain 
an exhaust manifold temperature of above 600°F or above. Under- 
hood temperatures increase after engine shutdown due to stoppage 
of the entire cooling system. It is believed that the increased, 
or high, temperatures caused vaporization of gasoline from the 
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carburetor float level into the engine compartment and 
when augmented by an oxygen saturated atmosphere created 
an environment in which autoignition of combustibles 
occurred. Hydrogen gas vented from the battery could have 
attributed to the combustible underhood environment. 

C ar No. 2 - Clos e-up Photograph Shown in Figure 12 
(a) Examination revealed that the most intense heat was in the 
engine compartment. The operator stated that the fire was 
first noticed after a -pop- in the engine compartment when 
he turned the ignition switch to the start position. It is 
believed that some underhood combustible material ignited in 
the oxygen saturated atmosphere when the ignition switch was 
turned. Sparks capable of igniting a combustible atmosphere 
could have been generated by any of the electrical components 
involved in the ignition sequences. There is no evidence that 
a fire occurred inside the engine crankcase. 

(b) The driver stated that the vehicle had been operated only a 
few minutes and for a short distance. Based on this the 
engine would have not attained normal operating temperatures. 
However, it was considered that the underhood environment con- 
tained sufficient combustible vapors to ignite by an electrical 
spark. 




(a) Examination revealed that the most intense heat was in the 
engine compartment. The evidence available indicates that 
the fire was first noticed in the engine compartment. The 
point of ignition is believed to have occurred in the engine 
compartment . 

(b) Driver stated that the vehicle was not operating when the 

fire was first noticed, but had been operating for a sufficient 
time to reach normal operating temperatures. 

(c) The underhood environment is considered similar to that in Car 
No. 1. That is, high temperatures and a relatively concentrated 
vaporization of gasoline from the carburetor augmented by an 
oxygen saturated atmosphere, created an environment in which 
ignition could have occurred either by autoignition or electrical 
spark. 

Working or operating vehicles in oxygen clouds or oxygen enriched 
environments is hazardous since it provides an increased potential for 
ignition. The minimum spark energy required for ignition, the flash 
point and the autoignition temperature are all decreased. The deficiencies 
responsible for the accident included a combination of system design, 
procedural and training limitations. The overall loading and dumping 
systems should include methods of verifying, tracking and control of 
oxygen clouds. Procedures for alternate routes for emergency vehicles 
and fire control of personnel entry into oxygen clouds should be 
prescr i bed . 
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The’ safety training courses should ? ncl ude add i t ional informa- 
tion to insure recognition and safe practices concerning LOX vapor 
hazards. Safe operations in and around areas suspected of having LOX 
vapors should be outlined in the safety courses. 

Present operational practices include venting and dumping of 
relatively large quantities of both oxygen and nitrogen, with the 
resulting formation of vapor clouds. These clouds which may accumulate 
and persist for appreciable periods of time, depending on atmosphere 
conditions, constitute a significant hazard to personnel and equipment 
with which they come in contact. Additional studies should be per- 
formed to permit assessment of the occurrence and properties of such 
clouds, the hazards associated with them and methods for preventing 
or safely operating in the presence of such clouds. 

3 . Apollo 13 Flight Mishaps 

The Apollo 13 mishap was initiated primarily by the rupture of 
the oxygen tanks which supplied the fuel cells and the breathing oxygen 
for the command module. The loss of oxygen resulted in the loss of the 
fuel cell power. The contingencies designed into the space vehicle, 
however, were sufficient for the lunar mission crew to overcome the 
emergency situation and use the available life support systems to return 
to a safe recovery. The detailed investigations provided reasonable 
explanations for the causes of the mishap and details of the interacting 
events leading to the final loss of power. Design limitations, materials 
incompatibilities, quality control (which includes inspection) and 
procedural deficiencies all contributed to the mishap. 
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A schematic showi-ng the various major systems of the Apollo/Saturn V 
launch vehicle is given in Figure 14. 

The oxygen and hydrogen tanks and fuel cells are located within the 
service module of the spacecraft. The arrangements of the equipment are 
shown in Figure 15- The internal components in the oxygen tank are shown 
in Figure 16. Two heaters in each tank supply the heat necessary to main- 
tain the design pressure in the oxygen tank. Fans circulate the oxygen 
over the heating elements to reduce any stratification present in the 
supercritical oxygen. 

The data obtained during the flight indicated that a problem arose in 
the oxygen tank (No. 2) when the electrical fan circuits were activated. 
Several short circuits were detected which were isolated to the fan circuits 
of the tank. The short circuit could have contained as much as 160 joules 
of energy and tests have shown that this is sufficient energy to ignite 
the pol ytetraf 1 uoroethyl ene (Teflon) insulation on the fan circuit wires 
submerged in the oxygen. 

The wiring conduit which contained the power leads for the fan motors 
and heaters and the instrument leads are fed through the vacuum shell in a 
hermetic seal which are then passed into the oxygen vessel through about 
1/2 inch diameter tubing. Figures 17 and 18 show the oxygen tank wiring 
and lines. The 1/2 inch diameter tubing containing the wiring was formed 
into a 10 inch coil with about 3 turns. The interior of the conduit is 
open to the pressurized oxygen.. to the point of the hermetic seals. 


19 


The insulation on the power wires may have become abraded due to 
vibration of the conduit and the rubbing of the wires against each other. 

The method of assembling leads into the conduit may have introduced strains 
into the wires causing increased insulation wear. These conditions could 
then lead to situations where sufficient energy, produced by shorting 
power leads, could ignite the surrounding Teflon. Most probably, the 
Teflon insulation fire progressed into the electrical conduit tubing at 
the top of the tank, open i ng the tank to the service bay. With the burn- 
through of the conduit, the pressure increased in the bay resulting in 
separation of the panel which enclosed the bay. The panel separation 
from the bay probably caused sufficient shock to close the oxygen supply 
valves. In all likelihood, the oxygen system (in tank 1) developed a leak 
either as a result of the shock when the panel separated or from the 
dynamics of the events associated with the failure of the tank 2 electrical 
conduit. A photograph of the oxygen tank in the service module bay is 
shown in Figure 19- 

Investigations of the operating and testing procedures conducted on the 
oxygen tank indicated that during the countdown demonstration tests, an 
oxygen detanking problem arose which had a part in the anomaly. The 
normal procedure for detanking of the oxygen, after the loading demonstration, 
could not be accomplished and the method employed was to boil the fluid 
through the use of the tank heaters and fans. It was thought that no 
damage would be sustained by the tank or its components because internal 
thermal switches provided protection. Thermal sensitive interlock devices 
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were connected in series with each of the heating elements to avoid 
excessive temperatures. The heater circuit would be automatically 
opened when the internal heater tube wall temperature reached 90°F and 
closed at 70°F. The use of the heaters to assist in detanking required 
a manual mode of operation which resulted in the switches opening under 
a load at twice the normal operating conditions for each heater. Tests 
showed that opening the switches under these conditions would fuse the 
contacts closed at the instant of power interruption. Tests have verified 
that with the heater on, for the duration experienced during prelaunch 
operations, fan motor wire insulation would be severely degraded. A 
photograph of the fan motor wire damage from simulated heater tests is 
shown in Figure 20. A fused thermal switch control obtained under 
simulated tests is shown in Figure 21. 

Studies of such mishaps (and especially using simulations of actual 
occurrences) provide not only the positive corrective actions, which 
reduce the possibility of such mishaps in similar launch vehicle systems 
but also indicate areas for improved safety designs and operations for 
systems using the same propellants. Problems requiring additional studies, 
research and development are also identified. 

Examples of the actions taken by NASA resulting from this mishap in- 
cluded not only a review and analysis of all oxygen systems in Apollo but 
a renewed awareness of the criticality of metals and materials combined 
with heat/ i gn i t i on sources in oxygen systems. A number of specific design 
changes and contingency operations initiated included the following 
(refs . 10): 
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(a) Redesign and replacement of 0^ tanks, and supply systems in 
the service moduleo 

(b) Provision of additional battery power for backup operation of 
the command service module. 

(c) Review and refinement of Apollo systems for contingency opera- 
tion and contingency plans. 

(d) Review and analysis of all liquid oxygen systems in Apollo 
and other systems. 

(e) Review and analysis by all NASA agencies for hazards and un- 
identified deficiencies in all ground based as well as flight 
systems using LOX and other oxidizer. 

(f) Renewed awareness of the criticality of metals and materials 
combined with heat/ignition sources in oxygen systems. 

(g) Increased review of anomalies when they occur. 

(h) Closer quality control contacts to be maintained with vendors, 
subcontractors and suppliers. 

CONCLUDING REMARKS 

The NASA recognizes that some of the reports prepared do not contain 
sufficiently detailed technical descriptions of the mishaps or are not specific 
as to the hardware and/or operating procedures involved with causes of the mis- 
haps. Efforts are presently under way to investigate methods of modifying the 
reporting procedures to include such information. The reporting requirements 
will also include more detailed explanations of the corrective actions that 
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are recommended for the continued use of the system. The inclusion of 
detailed cost estimates of the mishaps would be of considerable assistance 
in providing management with needed information for establishing risk manage- 
ment prevention programs. 

The compilation and review of mishaps with oxygen presented in the Appendix 
A and the brief descriptions of the interacting effects responsible for several 
of the mishaps emphasize some of the problems to be solved and provide basic 
inputs toward establishing adequate flight safety systems. Such studies are 
necessary to determine the potential hazards associated with oxygen, assist 
in the evaluation of the effects of such potential hazards, and finally help 
in establishing preventive and remedial measures. 



APPENDIX A 


LOX CRYOGENIC SYSTEMS 
Liquid Oxygen Acc idents/ I nc idents 


Acc ident/ Inc ident Description 

1. A fire occurred at a liquid oxygen 
pigtail vent valve when it was 
ignited by instrumentation wiring. 
Extensive damage to the system 
resul ted . 

2. When the valve was opened, a liquid 
oxygen container exploded due to use 
of improper lubricant on the LOX 

f i tt i ngs . 

3. A major explosion and fire occurred 
at a test facility during qualifica- 
tion testing of a booster engine 
fuel injector system. Major 
damage to the test set-up and the 
fac i 1 i ty resul ted . 

4. During qualification test of a LOX 
turbopump for a booster engine, 

the pump exploded on the 33rd start. 


5. Low stress/high frequency vibration 
during LOX fill operation of a stage, 
resulted in leakage of the GSE fill 
ducts and shutdown of the operation. 


6. A 63,000 gal. LOX spill occurred at 
a test stand when the LOX transfer 
valve was inadvertently left open 
after transfer operations were 
completed. 

7- During an engine sequence to check 
start tank, a LOX flowmeter spin 
occurred when the engine valves 
were opened. Spin lasted for 1 06 
seconds at 700 RPM. No damage. 


Causes 

A valve des i gn def i c i ency resul t i ng in a 
leaking LOX valve and inadequate installation 
of instrumentation circuits. 


Materials incompatibility and inadequate 
procedures and training to prevent use of 
unauthorized lubricants on LOX fittings. 

Material fa i 1 ure in that the LOX spl i tter 
plate failed from fat i gue, allowing LOX to be 
dumped into the test area. Contr ibut i ng cause 
to the damage was inadequate cleanliness and 
housekeeping in the test area. 


A pump design deficiency in that there was 
inadequate clearances between the LOX seal 
and the slinger and between the impeller and 
the backplate resulting in excessive rubbing. 

Material failure induced by low stress/high 
frequency vibrations caused by excessive 
fill rates. A fast flow rate of 10,000 gpm 
was completed and the slow flow rate was 
nearing completion. Engineering had not 
performed a fatigue analysis to determine 
an opt imum fill rate . 

The transfer procedure was signed off as 
"valve closed" but it actual 1 y was open . 

The bleed valve was open, as it should be, 
to allow bleed off of residual and caused 
the tank to drain through the transfer valve. 

A pressure differential caused by pressure 
build up in the LOX system while tank vents 
had been closed for 110 minutes. The 
deficiencies included both design and pro- 
cedural since evaluations had not been made 
for the tank vent closure time limits. 
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Accident/Incident Description 

8. An explosion of a LOX container 
occurred when the valve was opened. 

9. An explosion occurred in a LOX system 
when it was inadvertently over- 
pressurized due to installation of 
improper bleed plugs in a pressure 
regul ator . 

10. During transfer of LOX from tanker 
to tanker, the main valve mal- 
functioned resulting in dumping of 
3200 gallons of LOX on the ramp. 


11. During de-fuel ing operations after a 
test, a fire occurred at the vent 
when LOX was ignited by an electrical 
short during venting. 

12. A major LOX spill (26,000 gal.) 
occurred at a test stand during 
securing operations following a test. 
The tank valve was left open during 

a lunch period after the piping 
system drain was opened. 


13- During a human factors analysis of a 
stage fuel system, a potential for 
cross-connecting the fuel test line 
flex hose and the LOX sensing flex 
hose was discovered. Corrective 
action prevented such an event, 
however the potential for a major 
explosion existed. 


14. Apollo SC 204 fire. Fire in Apollo 
command module on launch pad resulted 
in fatalities and extensive damage. 
Atmosphere - 100% 0^ at approximately 

16 psia. Fire was propagated thru 
spacecraft by materials which were 
very flammable in 100% 0£ as compared 
to air. 


Causes 

Noncompatible lubricants used and inadequate 
work control procedures to perform inspection 
of LOX installations. 

Deficiency in work control procedures and 
inadequate identification of bleed plugs. 
Contributing was inadequate inspection of 
test installation. 


The liquid control valve design for the 
pressure build-up coil was deficient. It was 
jammed by a piece of aluminum which apparently 
came from one of the baffles in the tank. 

Tank and system design deficiencies con- 
tributed to the accident. 

A design deficiency in the test installation 
in that the LOX vent was located in a manner 
in which vapors were emitted in the area of 
electrical wiring. 

System was maintained in operational mode 
after the test due to planned test of the 
turbopumps. Subsequently, a decision was made 
to secure. The technician went through normal 
draining operations that would be done with 
the tank valve closed and did not close the 
tank valve. There was no verification pro- 
cedure in effect for valves. 

Lines had been designed in assemblies of 
flex lines of the same length and size which 
included both fuel and LOX lines. The lines 
were not color coded and were of the same 
length, permitting cross-connection. 


The probable source of ignition was associated 
with the spacecraft wiring. The results of 
the Investigation concluded the deficiencies 
which led to the disaster included inadequate 
work procedures, use ofnoncompat ible 
materials and inadequate system designs. 

These conditions included (a) a pressurized 
oxygen atmosphere in the sealed cabin; (b) 
large quantities of combustible materials in 
the cabin; (c) wiring and plumbing located in 
hazardous locations; (d) inadequate escape and 
rescue provisions for the crew. 
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Accident/Incident Description 

15. During operational testing of a 

stage, the gas generator LOX injector 
purge flex line was cross-connected 
with the thrust chamber injector 
purge flex line on an engine. This 
resulted in contaminat ion of the flex 
' lines and the LOX dome. No injury to 
personnel . 


16. During initial activation test of an 
Altitude Simulation Facility, a LOX 
fire occurred when LOX was turned on 
after normal purge operation and 
resulted in damage to a facility 
pump and piping. LOX pressure 
500-600 psi, pump driven by 250 HP 
motor . 


17. During altitude simulation test of a 
booster stage, a piece of Buna rubber 
broke off the LOX feed valve and 
caused impact ignition when it struck 
the pump impeller, destroying the 
pump. LOX pressure 98 O psig, driven 
by 250 HP motor. 

18. During a demonstration test involving 
nine pressure and temperature count- 
downs to demonstrate certain capabil- 
ities of foam insulation, a LOX tank 
dome ruptured and scattered throughout 
the test area. Occurred on seventh 
countdown when pressure reached 77 
psig in a scheduled 79 psig test. No 
personnel were injured. 

19. During pneumatic control subsystem 
checkout, a LOX chilldown pump housing 
was inadvertently overpressurized and 
had to be replaced when two adjacent 
lines were cross-connected. 


Causes 

A design deficiency in that adjacent flex 
lines were not properly coded and were of 
similar size and design. This contributed 
to the error on the part of the maintenance 
personnel who cross-connected the flex lines. 
Contributing causes were workman was in an 
uncomfortable posture when connecting the 
lines, with lighting that is not optimum, 
and cramped for space to use tools. 

Ignition apparently occurred as a result of 
contamination in the line and LOX impact. 

Piece of impeller between housing and 
impeller. Shock of impact damaged impeller,, 
Inboard thrust bearing failed which may have 
generated sufficient energy for ignition. 

The pump design was not adequate to prevent 
failure and the installation and maintenance 
procedures were not adequate to prevent con- 
tamination. Also purge and inspection pro- 
cedures were not satisfactory. 

A design deficiency in using noncompatible 
materials (Buna rubber) in a LOX system. 
Contributing cause was failure to transmit 
information from a previous incident, when a 
piece of Buna rubber was found in a LOX 
discharge screen. Valve material noncompatible 
with LOX. 

Failure to proof test the tank after a weld 
rework. Contributing causes were poor 
workmanship in the welding and inadequate 
inspection of welds. Complete history of 
repairs or modifications was not available. 


Installation error caused by identical pipes 
and joints located together in a manner that 
permitted cross-connection. The purge line 
to the chilldown pump was connected to the 
shutoff valve piping. A contributing cause 
to the accident was a design deficiency in 
not locating pipes so they could not be cross- 
connected or sizing or keying to prevent 
cross-connect i on . 
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Acc i dent/ I nc i dent Description 

20. During unloading of LOX from rail 
car to sphere, a LOX spill occurred 
when fill hose was disconnected. 

Two men were exposed to LOX. 

21. During countdown for static firing, 
a leak occurred at 12th level in 
the LOX fill and drain lines. The 
topping operation was discontinued 
for assessment but a dangerous 
condition resulted when an excessive 
number of people were allowed in the 
area during this emergency. 

22. A LOX system exploded during a static 
firing due to cleaning fluid corrosion 
in the system. 

23. A LOX system caught fire and exploded 
due to the use of hydro-carbon 
lubricants on connections. 

24. A titanium sphere used in a LOX 
system exploded and burned causing 
serious system damage. 

25. A LOX system was contaminated by use 
of incompatible ink used for internal 
stamping during manufacture of 
components, causing complete analysis 
of system and cleaning of components 
to be performed. 

26. Electrical wiring and plumbing were 
damaged in a test set up when 
electrical wiring near an oxygen 
pig tail vent shorted and ignited 
the oxygen. 


Causes 

Failure to allow sufficient boil off time 
prior to disconnecting fill line. Contributing 
cause was lack of specific instructions for 
boil off times of different types of cars. 

Material failure of the LOX hoses, causing 
cracks. Contributing to the potentially 
hazardous condition was inadequate control 
over entry of personnel to the area during 
an emergency. 


Nonccmpat ible cleaning fluids were used and 
periodic inspection for corrosion was not 
accompl i shed . 

Failure to specify compatible lubricants for 
use on oxygen system. 

Design deficiency in using a titanium 
sphere in a LOX system. Titanium is not 
compatible with LOX. 

A cleaning procedural deficiency in 
manufactur ing. Action had not been taken 
to determine compatibility of the ink with 
LOX prior to specifying its use. 


A design deficiency in the test installation. 
The pigtail vent was located in such a 
manner that it vented directly to adjacent 
wire bundles. Contributing was a pro- 
cedural error in continuing the test with a 
leaking LOX valve which resulted in the 
venting and the fire. 
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Causes 


Accident/Incident Description 

27. A malfunction occurred during a 
propellant laoding operation. 

The oxygen alarm (over 25%) and 
abort sequence were initiated. 

The emergency check list required 
opening of the boil -off valve but 
was purposely omitted because of 
the high oxygen concentration that 
had been indicated. The pressure 
increased reaching a value of 
29.5 psi at which time the valve 
opened. Oxygen was observed coming 
out of the enclosure area. Two 
explosions occurred after about 

30 minutes after the tank pressure 
indicated about 7 psi. 

28. After a propellant loading exercise, 
the liquid oxygen was being re- 
moved from a vehicle located within 
enclosed area. A major fire and 
explosion occurred destroying both 
the vehicle and enclosure. The fire 
initiated in the 40 micron stainless 
steel filter which was located within 
the f i 1 ter hous i ng . 

29. An explosion occurred during flow 
through a LOX ground-supply line 
filter. The facility used a stain- 
less steel filter cartridge main- 
tained against an aluminum support 
plate . 


30. During pressurization of LOX system, 
the flexible hose assembly failed. 
The inner line was 321 SS with a 
seamless tubing bellows and a wire 
braided outer covering. Tubing was 
rated at 2500 psig min. Examination 
of the failure indicated corrosion 
of the wire braid, and pitting of 
first and second convolutes. 


There was an excessive loss of oxygen after 
the pressure was allowed to build-up and 
suddenly released. The boil -off valve 
should not have been allowed to remain closed 
for that long a period. Ignition could have 
been due to a number of the electrical 
systems existing in the area just outside the 
enclosure section. System design deficiencies 
did not provide satisfactory venting systems 
or limit maximum valve closure times. 


Ignition of the primary fire was due to 
organic contaminants inside the filter case. 

The most probable source of organic con- 
taminants was (a) wicking of hydrocarbon con- 
taminants through flange to gasket, (b) con- 
tamination of the filter vent plugs and (c) 
accumulation of material present in LOX supply 
and LOX replenishment. 

Explosion was probably initiated by abrasion 
of aluminum by small hard particles present 
on filter. Chattering of steel cartridge 
against aluminum plate was noticed. Materials 
incompatibility, design deficiencies and in- 
adequate cleanliness all contributed to the 
accident. 

Failure of the flexible hose was probably 
caused by movement of the wire braid destroying 
the protective or passive layer on SS. Water 
entered resulting in corrosion. A design 
deficiency and limited inspection to ensure 
protection of the system against the environ- 
ment were responsible for the accident. 



Acc ident/ 1 nc ident Description 


Causes 
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31. During a LOX manual loading test, 
the corrugated flex-hose assembly 
located between the manual and 
remote operated pump suction valve 
ruptured immediately after the 
valve was opened. Wire mesh braid 
failed which allowed the pressure 
in the line to extend the flex hose 
until the weld at the end of the 
corrugations failed. Twisting 
moments exerted on the line and 
valve caused separation and move- 
ment of the system and pulled 
loose a pipe support. 800,000 
gallons of LOX was spilled and the 
tank was partially collapsed from 
vacuum. The seal bellows which 
connected the inner sphere relief 
valve standoff to the outer shell 
collapsed. The carbon steel pump 
baseplate was cracked. 


32. A LOX-RP-4 test vehicle was 

destroyed by fire and explosion. 
Initial testing indicated some 
difficulty with LOX feed system and 
the LOX pump inlet flange and inlet 
assembly showed erosion and metallic 
depos i ts . 


33- During preparation for a stage engine 
LOX dome flush procedure, the high 
pressure GN^ facility valve was 

opened to pressurize the tank with 
regulated 500 psig and simultaneously 
regulated 500 psig GN^ was intro- 
duced as back-pressure on a spring 
loaded vent valve on the tank. The 
vent valve blew out when the regulator 
supplying back-pressure stabilized at 
2100 psig instead of 500 psig. No 
personnel injuries, however the vent 
valve was destroyed. 


A design deficiency in the main pump suction 
valve and input lines permitted trapped air 
in the line to escape when the valve opened 
causing a rapid acceleration in the flow 
of liquid. The liquid reached the valve 
prior to achieving its fully open position. 

The liquid hammer effect forced the valve 
to a closed position causing excessive 
tension on the hose. The use of a flex hose 
upstream of the valve is indicative of an un- 
acceptable design. The inner sphere 
collapsed due to the negative pressure since 
the liquid flow could not be terminated. The 
relative location of the valving was not 
designed to permit termination of the flow. 
Design changes should include supports on 
either side of the remote operating valves 
and a remotely operated system to feed LOX 
into line upstream of valve. The system 
design was also deficient in not providing 
vacuum relief devices to prevent ullage 
pressure of inner sphere to reach below 
atmospheric pressure. 

Ignition of oxygen and pump parts was probably 
caused by heat due to friction produced by 
rubbing between impeller and wear ring 
diverter lip. Excessive pitting was evidenced 
on inner surface of volute. The pits contained 
foreign material like sand and chromic acid. 
Droplets of aluminum alloy found on wear ring. 
Design deficiencies and contamination in the 
line and pump parts contributed to the accident. 

System design studies and a hazards analysis 
of the facility installation and flush 
procedure, which would have detected the need 
for relief capability in the system, were not 
performed. Contributing was the failure of 
facility inspection to detect the absence 
of relief capability as specified in con- 
struction/installation drawings. 



Acc ident/ I nci dent Description 

34. A flex hose from the pressure 
checkout and calibration panel of a 
booster manufacturing tower was used 
to activate a stage LOX prevalve to 
a closed position so that installa- 
tion of a LOX low pressure duct could 
be performed. Second shift manufac- 
turing personnel unaware of the flex 
hose installation, pressurized the 
panel to 100 ps i for engine purge 
operations on another vehicle and con- 
sequently the prevalve actuator was 
subjected to approximately twice its 
operating pressure. 

35. During leak check tests on a LOX valve, 
following maintenance and cleaning, 
laboratory pressure of approximately 
2000 psi was applied through an un- 
secured flex line causing it to snap 
and in so doing, forcing the valve 

in an unmounted vise off the table. 

No personnel injuries. 

36. During cleaning of a 5000 gal. oxygen 
tank using trichloroethylene, a flash 
fire occurred in the tank when a piece 
of plastic fell into the tank and onto 
the heater element rod. One man 
received minor injury. 

37- During fuel cell pressurization of a 
flight vehicle the 0 ^ system was 

overpressurized to 25 % above design 
burst, when a new "K" bottle pressure 
source was added. Although no damage 
occurred, the system could have been 
damaged . 

38. During third acceptance test of a 
booster engine, a turbopump fire 
occurred as a result of LOX leakage 
into the pump gear box. There was 
extensive damage to the engine and 
minor damage to the facility. 


Causes 

Installation of the flex hose without formal 
documentation or procedural authorization 
and failure to pass information from one 
shift to another as to the panel configuration 
were the causes of the accident. 


The flex hose used was of excessive length 
and was not restrained. The test article 
was not properly secured prior to test, 
test procedures were not adequate and there 
was no inspection verification of the test 
setup. 


Procedural deficiency in not exercising 
adequate control of the area during hazardous 
cleaning operations, to prevent contamination. 
"Housekeeping" was marginal and area 
inspection lax. 

Failure to close regulator valve. The 
regulator valve on the "K" bottle source had 
been opened as the supply was depleted. When 
the new "K" bottle was added, the regulator 
valve was not reclosed, allowing a maximum 
of 2200 psig to be applied to a 350 psig 
system. 

A design deficiency in that there was shaft-to- 
seal movements which impacted the seal against 
the mating ring and caused LOX leakage into 
the gear box. 
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Causes 


Accident/Incident Description 

39- During a laboratory test for qualifica- 
tion of a LOX prevalve for engine 
shutdown of a booster engine, the test 
system exploded ten seconds after 
initiation, destroying the valve, and 
damaging the test facility and the 
test engine. 

40. During static firing test, a fuel 

leak occurred and resulted in a fire 
which burned through measurement wires 
causing test shutdown. Configuration 
of the LOX system following shutdown 
caused rupture of a LOX interconnect 
line and approximately 50,000 gals, 
flowed into the stage thrust structure 
and on engines. Fire damaged engine 
harnesses and hardware. 


41. During LOX tank repair, an electric 
heater blanket was installed on the 
LOX filter unit to provide heat inside 
the tank. The blanket overheated and 
the stage LOX tank caught fire, 
causing extensive damage. 

42. A thrust chamber purge was inadver- 
tently applied to a stage without 

the LOX dome purge being "on" result- 
ing in contamination of the LOX system 
and blowing off of engine exit covers. 

43- The main stage exploded during final 
countdown phase of static firing, 
destroying the stage and causing 
major damage to the facility. Ex- 
plosion caused by rupture of stage 
LOX tank. 


A design deficiency in that the pump 
developed an uneven two-phase flow and 
cavitation after closing of the LOX prevalve. 
This flow condition caused uneven loads on the 
impeller and ultimate failure. 


A polyethylene shipping disc had not been 
removed from a fuel connection and caused 
the fuel leak. Contributing causes were 
design deficiencies in the shipping disc such 
that it was not properly color coded or 
identified as a shipping disc and was not sized 
or configured to prevent inadvertent installa- 
tion on the operating system. Test termina- 
tion resulted in the closing of the oxygen pre- 
valves. With the closing of the prevalves, 
the LOX interconnecting valves opened auto- 
matically allowing "hot LOX" to escape into the 
suction lines. This resulted in geysering 
in the LOX feed system. 

A modification had been made to install the 
heater blanket without a formal engineering 
work order, without a hazard analysis and 
without safety approval. The installation of 
the 220V AC blanket was made to a 440V AC line. 
No temperature control devices were provided 
on the blanket. 

An erroneous verification to the operator 
that the RP-1 fuel simulator had been 
installed. Contributing cause was an 
engineering deficiency in not preparing an 
engineering order change requiring the 
installation of the simulator. 

Two redundant LOX vent valves failed to 
release due to presence of solid oxygen. 

Solids formed due to the use of cold helium 
gas for pressurization from tanks located 
within the liquid hydrogen fuel tank. 

Normally the helium passes through heater 
berore entering LOX tank. Contributing causes 
were failure to follow approved procedures 
and an unsatisfactory helium shut-off valve 
during cold conditions. Test preparation was 
inadequate in that a number of valves were over 
looked during pretest checks and were not in th 
proper position. 
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Causes 


Accident/Incident Description 

44. During inspection of a stage LOX 
tank, a ptetic container and cleaning 
pads were found in the screens and 
bottom of the tank. 

45. During removal of the oxygen shelf 
from a spacecraft, the shelf was 
damaged when a weld failure occurred 
on an installation adapter. 


46. During development tests of LH^-LO^ 

stage an explosion destroyed the 
booster stage after being loaded with 
propellants. The explosion took place 
just prior to the static firing. 


47. During development testing of a LOX- 
RP fuel stage engine an explosion 
occurred in the open air at the test 
facility. The explosion caused 
extensive damage to the test stand. 


48. During testing of LOX-Lh^ engine, a 

leak in the oxygen system and fire 
caused extensive damage to the test 
stand, liquid oxygen system, thrust 
chamber propellant valves and other 
flight hardware. Accident occurred 
during -initial testing of systems. 


The cleaning and inspection operations were 
inadequate. Procedures for work control 
during the installation were deficient. 

The cause of accident was due to both pro- 
cedural and design deficiencies. The proof 
loading requirements was authorized without 
following the prescribed procedures. In 
addition, the handling equipment was designed 
for a shelf weight approximately 90 lbs. less 
than the actual shelf weight. 

There was an excessive level of oxygen in 
the LH 2 tank vent line and a flash back from 

the burn stack at the end of the tank vent 
line initiated the explosion. The procedures 
for inerting the tank were inadequate 

permitting a dangerous oxygen concentration 
to be present. The system design was deficient 
in not providing measurements of the oxygen 
concentrations. 

An inproperl y designed gaseous oxygen igniter 
installation and nitrogen purge system pre- 
vented the flow of oxygen and ignition of the 
fuel in the chamber during the start sequence. 

A large amount of fuel flowed out of the 
engine and ignited outside the chamber. The 
plumbing installation was not designed properly 
nor were procedures set up to check the 
system operation. 

At the time of ignition, the chamber pressure 
increase produced an increase in system back 
pressure and was propagated into the oxidizer 
manifold. This was followed by a second 
pressure surge. The vibrational modes and 
high "g" loads resulted in actuator lipseal 
failure. During rapid valve closure severe 
vibrations caused metal -to-metal contact and 
rubbing of the aluminum against the Inconel-X. 
The heat developed due to friction is believed 
to have caused the fire. Hydrocarbon con- 
taminants found in turnbuckle cavities in 
valves may have also been the source of 
ignition. A satisfactory level of cleanliness 
was not maintained. Iron oxide, aluminum oxide, 
phosphate lubricant, fluorolube, aliphates 
hydrocarbon and paraffine hydrocarbon were 
found in the systems. Increased quality 
control surveillance required. Valve design 
changes suggested. 
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Acc i dent/ 1 nc ident Descr i pt i on 

49. A liquid nitrogen supply was con- 
taminated with oxygen and although 
no injuries or serious incidents 
resulted, the potential was great. 
Liquid nitrogen was supplied by a 
vendor in a truck that was used for 
the transportation of both liquid 
oxygen and liquid nitrogen. 

Apparently the truck was filled with 
liquid oxygen remaining in the vessel. 
The error was discovered when a 
technician noticed a bluish hue to 
the 1 i qu i d . 

50. During preparations for static testing, 
LOX was being pumped from two adjacent 
LOX barges. An explosion and fire 
occurred on the one barge and a fire 
on the second barge. The barge pump 
thrust bearing or LOX mechanical seals 
failed. The seal leaked and the 
radial bearing temperature dropped. 

The thrust bearing continued to fail 
allowing rubbing of the impeller and 
aluminum pump housing. 


51. During stage static firing test with 
LOX and Lh^ propellants, an explosion 

occurred destroying substantial 
equipment. The stage exploded before 
scheduled ignition of the propellants. 
Damage resulted to structures about 
800 ft away. Also damage to metal 
door on facility shop about 1 600 ft 
distant. Damage report heard 12 
miles away probably due to heavy 
cloud cover (reflection and focusing 
of sound waves) . 


Causes 

Requirements for vendor practices were not 
sufficiently detailed. Purging requirement 
specifications were not properly adhered to. 
The tank truck contents should be analyzed 
prior to transfer and specific gravity 
measurements taken of the tank contents. 
Further procedural actions should include 
consideration of one truck only for LN^ and 

to fill dewars from plant storage tank rather 
than vendor's local storage tank. 


The rubbing of the impeller against the 
aluminum housing caused ignition inside the 
pump. Catastrophic failure of pump occurred 
due to excessive pressures. A leak on the 
second barge was caused by loss of several 
studs on pump discharge flange due to 
excessive vibrations of the LOX pump. The 
recommended procedures in reporting out-of- 
limits temperature indications on the radial 
bearing of the LOX pump prior to the pump's 
failure was not followed. A design deficiency 
existed in that inadequate observation and 
instrumentation were provided to fully detect 
incipient problems. Pump design, although 
considered adequate was not capable of 
limiting deformation of the mechanical seals 
to pressures in excess of the 50 psig specifica 
tion which could occur due to the vaporization 
of LOX. 

The explosion was due to a catastrophic 
failure of a high pressure titanium sphere. 

The tank contained helium gas for propellant 
pressurization. A human error resulted in use 
of commercially pure titanium filler wire for 
welding the spheres which were made of 
Ti-6A1-4V. The use of pure titanium for 
welding in place of the filler having the same 
composition as thesphere resulted in a 30 to 
40% reduction in strength. The tank that 
initially failed was held to a support 
structure and during failure forced in the LOX 
bulkhead. The yield of H^+O^ was estimated to 

be 1% TNT equivalent. Attention was not given 
to production check or vendor control. 

Control and procedure check for welding not 
sat i sfactory . 
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Accident/Incident Description 

52. During launch pad clearing operation, 
three cars driven into an oxygen en- 
riched area ignited. LOX was dis- 
charged into a drainage ditch and 
cars driven into oxygen fog. All 
three vehicles were parked with 
engines off. Center vehicle engine 
key was turned on and fire started 
under the hood; other two cars 
started on fire immediately after. 

All three cars were destroyed. 


53 . During installation of equipment for 
engine testing, the purge lines to the 
fuel and oxygen systems were cross- 
connected and placing the LOX and 
fuel system in a common line. The 
oxygen lines were contaminated with 
hydrocarbons . 

54. During purging of a propellant loading 
assembly, a reducing fitting was 
installed in a LOX line and connected 
to a flex hose. When the valve down- 
stream of the fitting was opened, 

the workman was subjected to a stream 
of liquid oxygen . 


Causes 

The dumping of large quantities of LOX and 
the resulting formation of vapor clouds 
constitute a significant hazard to 
personnel and equipment with which they come 
in contact. The vehicles were driven into 
and parked in the oxygen cloud. A flammable 
mixture of oxygen and hydrocarbons accumulated 
under the hood of the three cars while they 
were parked with the engines off. The mixture 
in the second car was probably ignited by a 
spark from turning on the ignition key. For 
the other two cars, ignition probably took 
place when the flammable mixtures contacted 
the hot surfaces of the exhaust manifold. 

The quantity of LOX dumped into drainage 
ditch suggests a volume of 40% GOX covering 
about 20 acres to a depth of 4 feet. System 
design deficiencies and procedural deficiencies 
contributed to the accident. 

The procedures for connecting lines were 
not followed; in addition, the work was done 
without authorization. A design deficiency 
permitted such a line interconnecting. 


The accident was caused by both design and 
procedural deficiencies. A leaking LOX 
valve permitted trapping of LOX in the line. 
The connections were inadequate as well as 
the procedures which did not detail the 
operations to be followed. The quality 
control inspection of the connection was 
def i c ient . 
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Accident/Incident Description 

55- The Apolio 13 mission mishap involved 
failure of the liquid oxygen supply 
for the command and service module and 
consequently loss of fuel cell 

operation. Sufficient contingency 
actions were taken to ensure a safe 
return of the lunar mission crew. The 
liquid oxygen supply tank (Tank No. 2) 
failed at the electrical conduit tubing 
at the top of the tank. The release of 
oxygen into the bay 4 of the service 
module resulted in separation of the 
panel covering the bay 4 area. The 
panel separation caused the oxygen supply 
valves to close resulting in the eventual 
loss of pressure in the second oxygen 
tank (Tank No. 1 ) . 


Cause 

The accident was caused by interacting 
effects due to design limitations, materials 
compatibility limitations, and inspection, 
quality control and procedure deficiencies. 
The evidence from the studies conducted 
indicated that the poly tetraf 1 uoroethy 1 ene 
insulation on the fan wiring was ignited by 
a short circuit. The fans in the oxygen 
tank are activated to reduce any stratifica- 
tion in the supercritical oxygen. The 
burning of the insulation caused the tank 
pressure to rise resulting in the opening 
of the relief valve but the burning had 
progressed so that all electrical circuits 
to the oxygen tank had shorted. The fire 
apparently progressed into the electrical 
conduit tubing at the top of the tank and 
opened the oxygen supply to the service 
module. One of the service module panels 
separated resulting in the loss of tank 
pressure in the adjacent oxygen tank due 
to closing of oxygen valve. The procedures 
in operations and fabrication did not 
provide for sufficient review of anomalies 
when they occur. Sufficient awareness of 
the criticality of metals and nonmetals 
combined with heat and ignition sources in 
oxygen system was not demonstrated. 



APPENDIX A - CONTINUED 
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GOX SYSTEMS 

GASEOUS OXYGEN ACC I DENTS/ 1 NC I DENTS 
Accident/incident Description Cause 


1. Explosion and fire occurred in 2 inch 
stainless steel piping containing 
oxygen. The piping contained 2200 ps i 
oxygen and was fitted with a stainless 
steel ball valve. The stainless steel 
ball and pipe were ignited and the pipe 
burst in several places. 

2. Fire occurred in Two Man Space Environ- 
ment Simulator. Environmental con- 
ditions at time of fire were 100% 0 ^ 

at 380 mm Hg. The chamber was repres- 
surized and opened within 30 seconds 
subsequent to the initiation of the 
fire. The accident resulted in 
fatal i t i es . 

3. An oxygen high pressure gas system 
failed at valving. The GOX pressure 
was a maximum of 2250 ps i . Accident 
resulted in 2nd and 3rd degree burns. 

4. A GOX aircraft bottle failed causing 
fire and explosions. Bottle pressure 
was 1800 ps i . Accident resulted in 

i njur i es . 


5. Aircraft oxygen breathing equipment 
failed causing explosion and fire. 
Extensive damage to equipment and 
Injuries. Oxygen pressure - 1800 ps i . 

6. !n space-cabin experiment with 100% 
oxygen, hot resin from the base of the 
power tube in TV cabin monitor dropped 
on coolant lines passing beneath. 
Ruberoid insulation on coolant lines 
did not catch on fire but fumes from 
the hot resin alerted the crew. 

7- An explosion occurred when capacitor 
was discharged during experiment with 
Febetron Pulsed Electron-Beam X-Ray 
Equipment. The gas was 99% oxygen and 
was contained within flask designed for 
2015 psi; working pressure was 240 ps i . 


The pipe line containing the oxygen was 
considered to be contaminated with a 
halogenated hydrocarbon. Ignition occurred 
due to friction through the restricted 
opening of a ball valve as it was opened, 
(friction produced by operation of valve 
parts) . 

Fire attributed to short circuit caused by 
accidentally kicking power plug located in a 
floor-lined receptacle. The chamber contained 
two small portable CC^ fire extinguishers but 

one overheated and discharged through the 
pressure relief valve. System design and 
procedural deficiencies contributed to 
acc i dent . 

Accident attributed to either build-up of 
contamination on valve seat or sudden en- 
trapment of contaminants between ball and 
seat of valve. 

Materials incompatibility and procedural 
deficiencies contributed to accident. A loose 
nylon poppet moving under 1800 psi or heat 
generated by compression ignited the poppet 
in the valve, causing fire and explosion. 

Accident attributed to 1 etharge-gl ycerol 
cement in oxygen cylinder ignition by heat 
generated by compression of gas when cylinder 
valve was opened. 

The power tube in the TV cabin monitor failed 
causing ignition of the resin base and melting 
of the hot plastic. The molten resins and 
Ruberoid insulation did not burst into flame. 
Procedural and design deficiencies were 
responsible for the accident .Mater i al s 
failure also contributed to the accident cause. 

The explosion was caused by the capacitor 
discharge in pure oxygen which was mislabeled 
"Compressed Air, 79% Nitrogen, 21% Oxygen". 
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Acc ident/lnc ident Description 

8. An explosion and fire occurred in the 
filter of high pressure oxygen pump 
equipment. The equipment was used for 
charging self-contained breathing 
equipment oxygen cylinders. 

9. During test of a life support system 
oxygen source valve caught on fire and 
melted. The oxygen source consisted 
of two six (6) cylinder K-bottle 
assemblies hooked into a common 
manifold at 2200 ps i . The fire occurred 
when the valve was turned on to 
maintain the manifold pressure. Per- 
sonnel injury and system damage wassus- 
ta i ned . 


10. During conduct of pneumatic tests on a 
stage, an 8' flex line failed at 2000 
ps i and subsequent whipping damaged 
adjacent GN^ hard lines and propelled 

fragments for 75 ft. 

11. In preparation for an 0 2 subsystem 

checkout test of a flight vehicle, an 
incorrect hookup of a flex line to a 
water line instead of an 0 2 line 

resulted in rupture of the potable water 
tank and damage to the waste water tank 
and water panel when 250 psig GN 2 was 

applied to the H 2 0 system. No personnel 
injury. 

12. While performing a leak check of a 
ground service equipment setup during 
a prelaunch systems checkout on a 
spacecraft emergency 0 2 pressure system, 

a wrong flex line was disconnected and 
capped, allowing the 0 2 pressure system 

to be inadvertently pressurized to 50% 
above the design burst level. No damage 
resulted but it constituted a potential 
acc ident . 


Cause 

The explosion believed to be caused by the 
burning of oxidizable material in bottom of 
filter. The material was believed to be 
glycerine which was used for lubricating 
the pump. 

The fire apparently started in the valve 
seat which was made of a polyether material 
which had not been tested and approved for 
oxygen compatibility. Also, procedures for 
cleaning and inspecting of oxygen system 
components were not adequate. The system con- 
tained numerous contaminants consisting of 
aluminum chips, rust and organic materials. 
Additionally, there were no filters installed 
between the source and inlet valves and lines 
were of stainless steel with teflon parts. 

Material failure of the flex hose. Con- 
tributing to the extensive damage that 
resulted was the lack of restraint of the 
flex hose. 


The flex lines of the vehicle system were 
incorrectly tagged and no procedural in- 
structions or verification methods were used 
prior to application of GN 2 pressure. 


Failure to follow test procedures which 
required the 0 2 emergency system to be 

isolated from the GSE setup during leak checks 
of the GSE equipment. Contributing cause 
was inadequate. Quality control /supervi s ion 
and surveillance during critical prelaunch 
checks . 
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Acc ident/ I nc ident Description 

13- During pressurization of a stage 0^ 

system, it was inadvertently over- 
pressurized to 570 psig when the 
specified pressure was 350 psig. No 
damage occurred but potential damage 
to system was effected. 

14. Electric sparks (static discharge) 
were observed during handling of 0 2 

conditioning cannisters under atmos- 
pheric conditions in a vehicle. 
Static electricity was not bled off 
causing electrical discharge - which 
could be a source of ignition in a 
100% 0 2 atmosphere. No personnel 

injuries. 

15- During checkout of the fuel and 
propellant system in the high 
pressure test facility, the fuel 
and oxidizer orifices did not flow 
in accordance with specification. 
Complete analysis of the system 
revealed a plastic cover in the 
oxidizer line downstream of the 
orifice, reversal of the fuel and 
oxidizer orifices during installa- 
tion and damaged lines, strainer 
and orifices. 


16. During hydrostatic proof pressure test 
of pressure bottle for a spacecraft 
emergency oxygen system (13,250 psig) 
the bottle weld failed at 9000 psig 
due to a faulty weld. The pressure 
vessel was destroyed, however, no 
personnel injuries were sustained. 

17- After completing transfer of a C0 2 /0 2 

gas mixture from a "K" bottle to a small 
hoke-type cylinder, attempted closure of 
the cylinder needle valve resulted in 
the valve failing and the valve stem 
blew-out at a pressure of 1350 psig. No 
personnel injuries, however, a potentially 
hazardous condition existed. 


Cause 

Deviation from normal procedures to save 
time. The GSE regulator was increased to 
750 psig to save time and when pressure 
reached 350 ps i , the regulator was not reset 
until the pressure reached 570 psig. 


A design deficiency in selection of insulating 
material in the storage boxes for the 
cannisters. The material generated a static 
charge when the stainless steel cannisters 
were removed, due to inadequate grounding of 
storage boxes. 


Inadequate work control procedures during 
assembly, packaging, installation and 
cleaning. The plastic cover was identified 
as a type used to seal line ends during 
cleaning or packaging. The oxidizer orifice 
had been installed on the fuel line and vice 
versa during assembly and the strainer, lines, 
and orifice had received minor damage during 
installation. Contributing cause to this 
incident was inadequate inspection of critical 
work and failure to exercise positive control 
over materials used in assembly and packaging 
of critical flight systems. 

Inadequate manufacturing control and in- 
spection procedures. The weld seam failed 
due to incomplete fusion of the bottle half, 
apparently caused by either improper centering 
of the high intensity fusion welding on the 
seam or being directed at an incorrect angle. 
X-ray inspection of the welded seam did not 
reveal the discrepancy. 

Material failure of the valve stem and the 
apparent lack of an established procedure for 
periodic hydrostatic tests or other controlled 
maintenance as evidenced by no inspection or 
test record stamp on the cylinder. 
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Accident/ Incident Description 

18. A fire occurred during the operation 
of a high pressure oxygen service 
system. The nylon seats of ball 
valves were tested and found to de- 
compose and burn under the high 
pressure conditions. 

19 . During checkout test in high Mach 
number tunnel in which oxygen en- 
riched combustion air is made to 
burn with methane, a fire and ex- 
plosion occurred downstream of the 
orifice used to measure the flow. 

The fire occurred when a switch was 
operated which would permit actuation 
of an air signal for the control of 
the oxygen control valve. High 
pressure was introduced into the 
system which resulted in the rup- 
ture of the pressure transducers and 
transmitter allowing damping fluid 

to be discharged into the main oxygen 
line. The oil reacted with the oxygen, 
promoting combustion of the stainless 
steel piping and valving. 

20 . During proof testing of a spacecraft 0 2 

control module on an environmental control 
system, a fire occurred which blew off a 
cap boss when an 0 ^ ring seal failed per- 
mitting a subsequent 1400 psig pressure 

surge . 

21 . During oxidation/humidity qualification 
tests on spacecraft components in a 
test tank, (ambient pressure of 7 psia, 

95 ± . 5 % 0 2 , 95 ± 5 % humidity and 90°F), 

an explosion occurred within the tank 
when polyurethane foam used under the 
water pan swelled, causing a suspended 
electrical immersion heater to touch 
the bottom of the tank. Sufficient 
localized heating was generated to ig- 
nite the 0 2 saturated foam. No per- 
sonnel injuries, however laboratory 
equipment sustained damage and test 
units required replacement. 


Cause 

A design deficiency in specifying nylon 
seats for ball valves. Test results showed 
that nylon decomposed and burned due to 
heat of compression at high pressures. 

(Test pressures used were 1800 to 4000 psig.) 

A system design and operational performance 
deficiency permitted sufficient pressure 
from a previous run to remain in the line 
leading to the control system to operate the 
control valve without actuation of the air 
signal control systems. Opening of the 
control valve rapidly probably resulted in 
rapid compression with temperatures from 
1900 to 2200°R. The high temperature and 
pressure caused rupture of the bellows in 
the flow measuring instruments, atomizing the 
damping fluid and causing fire and explosions 
at downstream connections. Materia] and R&QA 
requirements were not sufficiently detailed 
to preclude the use of noncompatible materials. 


The 0 2 ring seals were being reused on sub- 
sequent tests in lieu of installing new seals. 
Also, a thread lubrication which was not 
compatible with oxygen was used and thereby 
caused ignition when the pressure surge 
occurred. 

A design deficiency in the test setup for 
conducting tests in high 0 2 and humidity 

environments. The highly saturable poly- 
urethane foam was not compatible with the 
test environment due to its proximity with 
the heater and susceptibility to ignition 
from heat generated by the heater. Also, 
there was lack of adequate safety analysis 
and Q.C verification prior to tests. 
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Accident/Incident Description 

22. GN^ and facility lines at a test ) 

facility were inadvertently cross- 
connected on the roof at a junction 
header when the lines were disconnected 
to correct a leak. Test setups were 
contaminated and systems/lines required 
purging. 

23. One person was fatally burned and one 
seriously injured in a space chamber 
under 100% oxygen when a flash fire 
occurred during routine maintenance 
from an electrical spark. The 
chamber was destroyed. 

24. During an unmanned 500 hour life cycle 
test of a space vehicle in a chamber 
with 100% oxygen, a fire broke out at 
480 hours from a spark from an elec- 
trical tape. Severe damage to the 
chamber and vehicle resulted. 

25. Two fl ight crew members were seriously 
injured in a space chamber under 100% 
oxygen when an electrical spark caused 
a fire on the thirteenth day of a 
simulated 14 day space mission. 

26. During a pressure test using a bio- 
satellite bleed and fill line to 
pressurize an 0^ system vessel to 3500' 
psig and bleed down to 500 psig, a 

fire occurred in the fill line when bleed 
down was initiated. Accident resulted 
in damage to the system and personnel 
i njury. 


Cause 

Procedural due to the lack of detailed 
maintenance/repair procedures and checkl i sts . 
Also, there was an installation design 
deficiency due to lack of identification of 
lines, i.e., no color coding or connector 
sizing, and lack of adequate work inspection. 


Inadequate maintenance procedures for 100% 
oxygen environments. Contributing was 
failure to ensure that non-flammable 
materials were used and failure to specifically 
rate equipment for use in oxygen environment. 

A design deficiency in the test installation. 
The heat tape had been installed as part of 
the test setup and had not been specifically 
rated for a 100% oxygen environment. The 
wires in the tape shorted, igniting the 
flammable material in the environment. 

A design deficiency in the installation which 
permitted an overloaded electrical circuit 
under the instrument panel to overheat and 
cause ignition. Contributing was lack of 
adequate planning and specification for 
equipment used in 100% oxygen environment. 

Primary cause was inadequate cleaning pro- 
cedures and specifications for 0^ components. 

The test article had received only standard 
cleaning at the manufacturer, and it was 
certified for use in 0 2 systems; however, 

aluminum chips and rust were found in the 
system. Neoprene was used for the regulator 
diaphragm, which was found unsafe for 0 2 

systems and there was no filter on the inlet 
side of the regulator. ignition was apparently 
caused by impingement of contaminants against 
the walls of the lines. 
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Accident/Incident Description 

27. During preparation for a reliability 
test on a GOX duct assembly of a 
booster stage, a six inch "hot" line 
ruptured under pressure of 3200 psig 
at 610 degrees F. and damaged 
adjacent piping. Uneven heating of 
the pipe caused it to overstress 
locally. The system was being 
pressurized with gaseous nitrogen. 


28. During acceptance testing of emergency 
oxygen equipment, an incident occurred 
causing an out-of-specification 
pressure condition to exist because of 
a damaged "0" ring. The "0" ring was 
damaged during assembly. No damage 

to equipment but a leak occurred 
requiring re-run of test. 

29. During checkout of ground support 
oxygen resusci tator, a fire occurred 
in the high pressure side and burned 
through the regulator. The unit 
charged with 2200 ps i oxygen was being 
readied as emergency equipment for the 
altitude chamber. The probable source 
of the fire was the primary seat in the 
regu 1 ator . 


30. A regulator controlling an oxygen and 
breathing air system failed to shut 
off permitting gas to escape and 
causing a fire. Examination indicated 
heat and flame damage through the port 
area opening and charring of the 
regulator seat. The valve was melted 
and deformea. 

31. During preparation for altitude chamber 
pumpdown for spacecraft purge and leak 
check, 100% 0, was used for the purge 

instead of 65% 0 2 and 35% N^. Damage 

did not occur bu the environment 
presented a potential fire hazard. 


Cause 

A design deficiency in the test setup. The 
heating element on the line permitted uneven 
heating and caused hot spots which weakened 
the line. The instrumentation provided 
"average" thermocouples readings and did not 
provide loca temperature of hot spots. Un- 
authorized substitutions were utilized and 
thermocouples were of a different size. Con- 
tributing causes were inadequate procedures 
for control of parts purchases and inadequate 
work control procedures. 

Incident was caused by improper installation 
procedures. The back-up ring had been 
damaged and the "0" ring was extruded into 
the damaged ring. The damage was not noticed 
by inspection. 


The primary cause of the accident was the 
use of incompatible materials. The seat was 
made of nylon, a material considered un- 
satisfactory for 100% oxygen use. Studies 
indicated that either a small particle or 
thread of the nylon seat left from the initial 
machining ignited the nylon seat. The in- 
spection and procedural deficiencies permitting 
material not satisfactory for oxygen also 
contributed to the accident. 

A materials incompatibility and design de- 
ficiency were the cause of the failure. A 
metallic object was removed from the inlet 
port of the regulator. The metal ball 
originated upstream of the regulator and the 
impact was probably responsible for the 
ignition of the nylon seat. 

The cause of this incident was human error 
since the pressure relief and panel con- 
figuration were specified in the test check- 
out procedures. Procedural and design 
changes should be added to require gas 
sample analysis before mixture enters space- 
craft. Lack of QC ver i f icat ion . and lack of 
inspection of valve settings contributed to 
acc i dent . 
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Accident/Incident Description 

32. During fuel cell pressurization of 
vehicle oxygen system, the tank was 
overpressurized to about 25% above 
the design burst valve. No damage 
was done but a serious hazard was 
produced . 

33- While performing leak check of space- 
craft emergency oxygen systems, the 
wrong flex line was disconnected and 
capped allowing systems to be 
pressurized to 900 psig, 50 % above 
des ign burst 1 evel . 

34. Fire damage to parts of rocket engine 
used in lifting body research air- 
craft was noticed after return from 
flight. Fire damage was also sus- 
tained on the aircraft control sur- 
faces adjacent to the engine. The 
fire was probably at a low level of 
intensity initially, yet sufficient 
to melt a section of aluminum GOX 
line. One of the lines appeared to 
have been softened, swelled by in- 
terna! pressure and eventually rup- 
tured. Fire must have intensified 

as GOX lines ruptured causing addi- 
tional damage. 

35. During the pressure testing of a tank 
to be used for the testing of a quick 
release manhole cover, the tank burst 
causing extensive damage. The tank 
burst at a pressure between 60 and 

67 psig. The tank had withstood a 
pressure of 60 psig in a previous test. 


36. During receiving inspection tests, 
convoluted flexible ducts of the "Y" 
GOX collector were damaged when a 
test fixture was improperly installed. 
No injury to personnel. 


Cause 

During the pressurization process, the "K" 
bottle source of gas was replaced but the 
regulating valve had not been adjusted for 
the higher tank pressure. Procedural and 
design limitations were the cause of the 
acc i dent . 

A test/checkout procedure was used but 
human error was responsible for the accident. 
Q.C. surveillance was inadequate to catch 
mistake. .System design was deficient in 
permitting making wrong connection. 

The fire probably started just after pro- 
pellant jettisoning was initiated. Ignition 
source could have been the engine nozzle 
extensions. The system design deficiencies, 
materials limitations and procedural de- 
ficiencies contributed to the accident. 
Material specifications did not consider the 
use of less vulnerable flexible hydraulic 
lines, instrumentation wiring and other 
damping devices to the fire damage. Opera- 
tional procedures were deficient in not 
permitting a safe minimum delay between shut- 
down and jettison of the propellants. 

Material failures and their relationships to 
engine damage when exposed to fire were not 
eval uated. 

Insufficient communication among those 
responsible for the test to provide the design 
information for the tank testing was the 
cause of the accident. A misunderstanding 
concerning the tank design pressure existed 
between the designers and operators. Blue- 
print interpretation indicated the tank had 
been designed for 150 psig when it actually 
had a limit of 50.7 psig. 

The primary cause was procedural in that 
the workman neglected to restrain the 
flexible ducts with available clamps. The 
bellows ruptured at 350 psi and quality 
control instructions did not provide warning 
n ote to ensure use of bellows retaining 
cl amps. 
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Acc ident/ I nc ident Description 

37. An employee collapsed while wearing 
an air mask supplied with air from 
a cylinder tagged as having been 
checked for oxygen. He was revived. 


38. A LOX pre-valve actuation control valve 
was overpressurized when a connecting 
flex hose was used incorrectly. The 
hose was installed from a calibration 
panel by one shift and used incorrectly 
by the 2nd shift. Major damage 
resulted from the overpressurization. 

39. During leak check operations on a LOX 
valve, pressures of approximately 2000 
ps i were applied through an unsecured 
flex line forcing the line to snap and 
break the line and valve. No personnel 
injuries. 

40. During pressurization of a stage test 
ground tank system to support a stage 
LOX dome test, a 500 psig spring 
loaded vent valve on the LOX tank 
failed. The regulator indicated 
pressure of 2100 psig instead of 500 
psig. 

41. During proof test of a check valve in 
a test chamber, GN^ at 4800 ps i was 

admitted through an inlet port while 
the outlet port was capped. The valve 
was removed from chamber after which 
the valve ruptured. No injury to 
personnel . 

42. During testing of a pressure vessel, a 
rupture of the flange to head weld 
caused damage and injury to nearby 
personnel . 


Cause 

The oxygen content of the air in the 
cylinder was less than 1%. The supplier 
usually mixed N 2 and 0 2 in the cylinder but 

in this case failed to add oxygen. Pro- 
cedural and system design deficiencies con- 
tributed to accident. 

The primary cause was procedural in that 
the flex hose was connected without documenta- 
tion or procedures. The 2nd shift pressurized 
the system to 1000 ps i which was 500 ps i 
above the operating pressure. 


A procedural deficiency indicating that a 
lack of test set-up and operational in- 
structions was the cause of the accident. 
Proof test procedures were not available. 


The system did not have sufficient regulator 
relief capability indicating a design de- 
ficiency. A procedural deficiency was also 
evident in that a hazards analysis of the 
installation was not performed which would 
have detected the need for the regulator 
relief capabi 1 i ty. 

The primary cause of the accident was a 
design deficiency. The trapped GN 2 in the 

check valve was at about -285°F in the test 
chamber and at room temperature, the gas 
expanded causing rupture of the valve. The 
design did not provide for the release of 
pressure when test article is in chamber. 

The pressure exceeded operational limits due 
to an inoperative pressure regulator. The 
LOX sensor gave faulty readings on the 
pressure gage. Procedural and design 
limitations were responsible for the accident. 
Procedures were not sufficiently detailed to 
assure no initial pressurization with 
personnel nearby. 
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Accident/Incident Description 

43. During pre-launch leak checks of 
instrument containers with Gl^ at a 

pressure supply of 1750 psig, a 
regulator failed. The flow was by- 
passed causing overpressurization 
of the container and damaging the 
bulkhead and tank. 


44. During a proof pressure test of an 
oxygen pane I , the low pressure side 
(210 psig) was inadvertently sub- 
jected to pressure from the high 
pressure side (1500 psig) when the 
high pressure shutoff on a common 
"T" connection was not closed. 

45. During a space simulation test, an 
explosion occurred in the oxygen 
system of a test chamber causing 
system damage. 

46. During checkout of a check valve under 
cryogenic temperatures in a test cell, 
an explosion occurred injuring one 
person and causing minor damage to 
equipment. System was being 
pressurized to 3000 ps i and explosion 
occurred at 2900 psi. 

47. The oxygen supply system of a vehicle 
environmental control system was con- 
taminated with mercury during replace- 
ment of a solenoid valve. Mercury 
was discovered in the cold trap of the 
leak detector during subsequent leak 
checks. Incident required complete 
analysis and cleaning of entire 
system . 

48. During qualification testing of a 
spacecraft fuel cel 1 power system, the 
test was prematurely terminated by an 
electrical failure caused by carbon 
deposits from cleaning fluid residuals 
left in the system. 


Cause 

The cause was procedural in conjunction with 
a design deficiency. A plastic dust cap 
was left in the quick disconnect for the 
instrument container pressure sensor causing 
erroneous pressure readings. In addition, 
a 900 psi pressure source was used on a low 
pressure system with the bypassing of the 
regulator. No relief valve was provided in 
the container. 

Procedural error in failing to close the 
high pressure side of the "T" connection. 
Contributing was lack of adequate verifica- 
tion of test installation prior to tests and 
failure to include adequate warning notes 
in test procedures. 

A design deficiency in that noncompatible 
seals used in the ball valves were subject 
to impact ignition with oxygen. Subsequent 
impact tests confirmed this compatibility. 

The operator failed to shut off the power 
and close the solenoid valves after a 
previous run, as required by the test 
procedure. Contributing causes were a leaking 
hand valve, lack of a pressure relief device 
in the test set-up and failure to provide 
operator with the latest revision to the 
test procedure. 

Lack of adequate procedures for the control 
of instruments containing mercury in the 
manufacturing and test facilities. Mercury 
was apparently introduced through a 
solenoid bypass valve which had been replaced 
in the system. 


The cleaning procedure being used was in- 
adequate to ensure complete removal of all 
cleaning fluid residuals. Contributing was 
failure to establish by analysis and test, 
the compatibility of the cleaning agent with 
the carbon deposits and with the oxygen 
system electrodes. 
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Accident/incident Description 

4g. During a manned crew training test 
in a vacuum chamber* electrical 
arcing of an interior overhead 
fluorescent light occurred. The 
chamber pressure was equivalent 
to 200*000 ft. altitude. No 
personnel injuries or hardware 
damage occurred. 


50. During qualification test of an 
environmental control system in an 
altitude chamber* the commercial 
grade strip heater tape failed 
causing shorting of the wires and 
ignition of the flammable material. 
The altitude chamber was at 5 ps i 
and 100% oxygen. The control 
system and test equipment were 
destroyed . 


Cause 

Primary cause was due to chamber design 
deficiency. The failure of fluorescent 
lights was found to be common but was 
not taken into account in the chamber 
design. Sufficient heat is generated to 
melt portions of the electrical fixture 
and wiring* the metal end of the fluorescent 
tube and finally shatter the glass near the 
anode. Sodium in the glass acts as a cathode 
after extended usage making arcing possible 
between the anode and the glass. 

System design and procedural deficiencies 
were responsible for the accident. The 
test set up evolved from sketches and oral 
communication. Approved test hardware 
materials were not used. Adequate safety 
and emergency procedures were not established. 
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NON-NASA MISHAPS 


During servicing of a T-33 aircraft with 
oxygen with operating pressures of 350 
ps i on cockpit gage and 400 psi on cart 
gage, a muffled explosion was heard. 

Flame was observed coming out of nose 
wheel well. The explosion and fire 
burned a hole in the aircraft skin. 

Fire started from within tubing and 
fitting system. Aluminum tubing wall was 
burned away (partially) in direction of 
oxygen flow. 

During servicing of oxygen system on T-33 
aircraft, an explosion and fire occurred 
at the oxygen cart being used for pro- 
viding gaseous oxygen. A man at the 
oxygen cart was controlling the pressure 
regulator. The pressure at the regulator 
was being increased and the aircraft gage 
was being observed to increase slowly. 

The fire at the cart resulted in fatal 
injuries. 

After an aircraft landed, an explosion 

occurred from within the cockpit area. 

The pilot noted some smoke from the cock- 
pit area with subsequent flash fire. 


Aircraft cockpit oxygen emergency bottle 
exploded during servicing (T-28) on pre- 
flight check. Intense fire in seat pan 
area. (Similar accident occurred 4 
months later.) 


During a preflight check which involved 
turning on the aircraft oxygen system, 
a fire started. The fire was accelerated 
due to the oxygen and attempts to put out 
the fire were unsuccessful. 


The fire started within the tubing and 
fittings due to internal contamination of 
system with hydrocarbons or possible over- 
torquing of connections. Improper servicing 
procedures generating excessive heat in the 
system contributed to mishap. 


It was believed that the fire was caused by 
grease or oil contamination present on the 
purifier cy 1 i nder . 


A low pressure oxygen check valve failed. 

A small crack was noticed in the fitting 
which was probably caused by overtorqu i ng . 
Leakage of oxygen into the are 3 which contained 
a large amount of oil resulted in the fire 
and explosion. 

Cause of failure believed to be due to 
contamination in oxygen system. Contamina- 
tion considered to be introduced during 
servicing. Rapid charging resulted in 
excessive temperature and pressure due to 
oxidation of rubber plunger washer on valve 
cone. 

An oxygen valve failed due to fatigue and the 
escaping oxygen impinged on the insulation 
and surrounding materials. System design 
deficiencies prevented shutting off the 
oxygen supply. 
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During an inerting operation of an air- 
craft fuel line with oxygen, a fire 
and explosion occurred destroying the 
aircraft and resulting in a number of 
fatal (ties. 


An explosion and fire erupted during 
servicing of rear cockpit (T-2 8 aircraft) 
high pressure gaseous oxygen bottle. 

The oxygen 1 ine was connected from the 
servicing cart and prior to pressurizing 
bailout bottle, the fire occurred. 


Pilot, in aircraft, was preparing for 
test flight when flame shot out between 
his legs. The flame came from under the 
seat pan and was similar to a blow torch. 
The pilot released the leg straps and 
rolled clear of cockpit, receiving burns 
on both hand and legs. 

Fire occurred in cockpit area of air- 
craft. Pilot experienced general 
failure, followed by smoke in cockpit 
and within seconds the oxygen was lost 
and flames erupted. Pilot received 
burns; ejected and rescued by helicopter. 
Aircraft exploded prior to impacting 
water , 

Aircraft was being prepared for servicing 
with oxygen. The oxygen cart had been 
positioned near the aircraft; the hose 
pressurized to 425 ps i and while being 
connected to the aircraft receptacle 
an explosion and fire occurred. 

Fire was initiated in cabin of aircraft 
located in hangar. Fire provided 
sufficient heat to melt aluminum fitting 
controlling oxygen. Fire spread to 5 
other planes. 


The material being used for inerting was 
oxygen instead of nitrogen. The cylinders 
were stenciled oxygen. The high pressure 
oxygen reacted with the fuel remaining in 
the lines. System design and procedural 
deficiencies contributed to the cause of 
the mi shap. * 

Hydrocarbon contamination in the area of the 
servicing connection was suspected as causing 
the fire. The contamination was due to 
personnel not following safety precautions. 
Contamination came in contact with the hose 
fittings; lines and hoses not purged nor 
stored properly. The filter valve indicated 
damage due to dragging on hard ground (con- 
crete) . 

The cause of the mishap was suspected to 
be failure of non-compatible nylon valve 
seat in the emergency oxygen bottle. Fire 
was fed by seat pad and other material. 


Cause not known but considered to be due to 
material failure in oxygen system. 


Prior to explosion a small leak was heard in 
vicinity of purifier. The purifier and 
filter element were burned. The use of non- 
compatible materials and procedural 
deficiencies contributed to mishap. 

Fuel leaking from line supplying heater was 
ignited by short circuit in battery. 

Aluminum fitting melted off control allow- 
ing to be fed into fire. Material 

failures combined with system design and 
operational procedure deficiencies con- 
tributed to accident. 
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Fire initiated in passenger compartment 
of aircraft while men were removing 
linoleum with acetone and cleaning seats 
with other highly flammable solvents. 
Fire spread rapidly causing oxygen 
relief vent valves from 4 cylinders on 
board to open. Hangar's deluge system 
conf i ned the fire. 


Fire was believed to be initiated by a 
static spark or spark from an extension 
cord. Due to the high temperature 
developed, the oxygen relief valves opened, 
releasing and intensifying the fire. The 

system design and operational procedures 
employed contributed to the accident. 



APPENDIX B 


DEFINITION OF MISHAPS - NASA SAFETY MANUAL 


TYPE A 
(Accident) 

Any fatality, five or more persons seriously injured, 
$100,000 (or more) damage to NASA/NASA contractor 
equipment or property, or aircraft destruction. 

TYPE B 
(Accident) 

Serious injury to four (or fewer) persons; property 
damage over $10,000 but less than $100,000 to 
NASA/NASA contractor equipment or property. 

INCIDENT 

A mishap (less than accident severity) to persons or 
property, over $250 but less than $10,000, or a non- 
serious injury. 

MISSION 

CONTINGENCY 

Any event which jeopardizes a mission, prevents major 
mission objective, or premature mission termination. 

AVIATION 

FLIGHT 

ACCIDENT 

A NASA (type A or B) accident which involves NASA 
owned or operated aircraft or NASA flight crews, 
passengers or test personnel while on flight duty 
and which occurs after the engine(s) has been started 
with intent for flight. 
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TABLE I. - RUBBER AND SOFT GOODS 
USED IN RESUSCITATOR 

Sample Description Composition 


Primary seat 
O-ring seal at jet base 

Floating member 
diaphragm 

Floating diaphragm 
fiber reinforcement 

O-ring seal at end of 
inlet valve camshaft 

Bellophragm grommet 

Secondary seat 

Inlet valve seat 

Regulator core O-ring 

Upper diaphragm 

Upper diaphragm re- 
inforced fibers 

Safety valve rubber 


Type 6/6 nylon 

Butadiene acrylonitrile 
rubber 

Chloroprene (Neoprene) 
rubber 

C often 

Butadiene acrylonitrile 
rubber 

Poly butadiene rubber 

Chloroprene (Neoprene) 
rubber 

Tetra-flouro -ethylene 
polymer (TFE Teflon) 

Butadiene acrylonitrile 
rubber 

Butadiene acrylonitrile 
rubber 

Nylon 

Natural rubber 
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Figure 1. - Distribution of causes of mishaps with liquid 
oxygen (more than one cause factor is involved in most 
mishaps). 



Figure 2. - Distribution of causes of mishaps with gaseous 
oxygen (more than one cause factor is involved in most 
mishaps). 
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Figure 3. - Comparison of cause factors for liquid and gaseous oxygen. 
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Figure 5. - Cutaway sketch of the resuscitator regulator illustrating the 
functioning position of various components 
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Figure 4. - Thermal-decomposition-toxicity index versus 
temperature. 



Figure 6. - External view of resuscitator regulator illustratin a , uptured safety valve and flash 
damage to the pressure gauge. 
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Figure 9. - LOX system schematic showing LOX chilldown outlets to ditch. 


Figure 10. - Burned cars in relation to oxygen tank and fence. 
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Figure 12. - Damaged car number 2. 




Figure 13. - Damaged car number 3. 
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Figure 15. - Arrangement of fuel cells and cryogenic 
systems in bay 4. 


Figure 14. - Apollo/Saturn V space vehicle. 






Figure 19. - Oxygen tank in service module bay. 






-6604 


CS- 54828 


Figure 20. - Damaged Teflon insulation. 
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Figure 21. - Fused thermal switch control. 
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